Data Processing Policy

How VoyajeBoard processes personal data, including subprocessors, retention, international transfers, and regional addenda for GDPR, UK GDPR, CCPA, LGPD, and Quebec Law 25.
Effective May 6, 2026
Updated November 3, 2026
Regional addenda included
Who We Are
VoyajeBoard is operated by Voyajer Media LLC, an Illinois limited liability company. This Data Processing and Data Protection Policy explains how VoyajeBoard collects, uses, stores, shares, and protects personal data across the VoyajeBoard mobile app, the VoyajeBoard web app, the marketing surface at voyajeboard.com, and any related services.
Effective date: May 6, 2026.
Last updated: November 3, 2026.
Postal address: Voyajer Media LLC, 1320 N. Wicker Park Ave, Chicago, IL 60622, USA.
Contact: support@voyajeboard.com.
Personal Data We Process
We process the data needed to run collaborative trip planning, account features, and the optional Plus subscription. We do not process IDFA, payment card numbers, phone contacts, health data, sensitive special-category data, or browsing history.
Account: email, display name, first and last name, date of birth (to confirm you are 13 or older), Appwrite user identifier, and marketing email preference.
Trip content: destinations, itinerary items, comments, reviews, photos, receipts, shared-budget records.
Diagnostics: aggregated screen views, taps, feature usage, crash logs, performance events (via Sentry and PostHog).
Subscription state: product id, renewal state, entitlement dates (via RevenueCat, or Stripe for web purchases). The app stores handle in-app payment details and Stripe handles web payment details; VoyajeBoard never receives card numbers.
Push tokens and notification preferences, only after you grant the OS-level permission.
Network and device data: the IP address of each request to our servers and device or installation identifiers, used for security, fraud and abuse prevention, rate limiting, and diagnostics.
Sign-in activity: IP address, device name, platform, and an approximate city and country estimated from the IP address, shown to you in Settings and kept for 180 days.
Lawful Bases
Where required, we rely on one or more lawful bases under GDPR Article 6 (and the equivalent in other regimes).
Performance of a contract: account features, trip storage, collaboration, subscription management.
Legitimate interests: product analytics, safety, fraud prevention, affiliate-click measurement, service improvement.
Consent: notifications, optional analytics where required, marketing communications.
Legal obligation: tax, regulatory, and law-enforcement requirements.
Subprocessors
We share personal data with a curated set of subprocessors only as needed to operate the Service. The current list is summarized below. If organization agreements are offered in the future, they will carry their own subprocessor list. Every subprocessor that receives personal data, including AI providers such as OpenAI, is bound to protect it with the same or equal protection described in this policy and the VoyajeBoard Privacy Policy.
Infrastructure and storage: Appwrite (database, auth, storage, and the approximate city and country of each signed-in device), Render (server hosting), Vercel (hosting for VoyajeCommand, our internal support and operations console), Inngest (scheduled jobs for that console, such as marketing email).
Analytics and diagnostics: Sentry (crash and performance), PostHog (product analytics), Better Stack (Logtail) (server logs, which can include IP addresses).
AI: OpenAI (trip planning and itinerary suggestions, itinerary narration, activity recommendations, suggestions for open time in a trip, packing suggestions, budget estimates, expense category suggestions, receipt image reading when a traveler scans a receipt, trip recaps, alert summaries, destination matching, automated review moderation, and backup translation when Google Cloud Translation is unavailable). Travelers are asked for permission before their information is first sent to OpenAI from an AI feature, and can withdraw it in Settings > Privacy & Security > AI Data Sharing.
Safety: Google Cloud Vision (automated safety screening of every uploaded photo), Abstract API (IP address checks that authorized staff use to prevent fraud and abuse).
Travel data and partner links: TripAdvisor, Viator, Booking.com, Expedia, Skyscanner, GetYourGuide, Amadeus, AeroDataBox through RapidAPI (flight status from flight numbers and dates), mediastack (travel news), Federal Reserve H.10, Open-Meteo, WeatherAPI.com, Unsplash, Google Places, OpenStreetMap Overpass (map transit data from coordinates), Amazon Associates (product links on the website), Impact (brand and product links and labeled ad images on the website).
Translation: Google Cloud Translation (translating content into the traveler's language).
Subscription and payments: RevenueCat, Apple App Store, Stripe (web checkout and subscription management). Plus is not currently sold through Google Play.
Sign-in: Apple (Sign in with Apple).
Email and notifications: Postmark (transactional email, and marketing email for travelers who opt in), Expo Push Notification Service (push notification delivery).
Retention
We keep personal data only as long as needed for the purposes in this policy, unless a longer period is required for legal, safety, fraud-prevention, backup, or dispute-resolution reasons.
Account, profile, settings, trips, media, and shared-budget data: kept while the account or related trip is active, deleted or de-identified after deletion, with backups retained up to 90 days.
Analytics events, partner impressions, and product interaction data: 90 days. Affiliate booking records: until the traveler deletes them or the account, unless needed longer for commission reconciliation, tax, fraud-prevention, or dispute reasons.
Crash, performance, and diagnostics data: error reports for 30 days unless needed longer for security, reliability, legal, or abuse investigations.
Sign-in activity (IP address, device, approximate city and country): 180 days.
Support, safety, legal, and abuse records: up to 3 years or longer when required.
International Transfers
VoyajeBoard and its subprocessors may process data in the United States and other countries. Where required by law, we rely on Standard Contractual Clauses (EU SCCs), the UK International Data Transfer Addendum, or other approved safeguards. OpenAI API traffic should be configured for United States processing where available, and prompt content is minimized before being sent to any AI provider.
You can request a copy of the transfer safeguards relevant to your personal data by emailing support@voyajeboard.com.
Affiliate Click Tracking
When you tap a booking link, we record the click for analytics. The destination partner may receive an attribution parameter that identifies VoyajeBoard as the referrer. They do not receive your personal information.
Partner websites and apps may collect information from you if you continue with them, create an account, make a booking, or contact their support team.
Your Rights
Depending on where you live, you may have rights related to access, correction, deletion, restriction, portability, objection, withdrawal of consent, and complaints to a regulator. Section 14 below summarizes the regional addenda.
Use in-app controls for profile visibility, blocked users, notification preferences, data export requests, deletion requests, and account deletion.
Contact support@voyajeboard.com for privacy requests or complaints.
Children under 13 are not permitted to use VoyajeBoard. Users confirm they are 13 or older during registration.
Breach Notification
If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours and, where the risk is high, will notify affected users without undue delay.
Regional Addenda
The following regional summaries supplement the primary policy above for residents of the listed jurisdictions. Where a regional rule conflicts with the primary policy, the regional rule controls.
European Union and EEA (GDPR): Controller is Voyajer Media LLC, at the address above. Rights under GDPR Articles 15 through 22 are honored. The right to lodge a complaint with your national supervisory authority is preserved. Article 27 EU Representative will be appointed before any campaign that specifically targets EU data subjects; interim contact is support@voyajeboard.com.
United Kingdom (UK GDPR): same rights and timelines as the GDPR addendum, interpreted under UK law. Supervisory authority is the ICO. UK Article 27 Representative will be appointed before any UK-targeted campaign; interim contact is support@voyajeboard.com.
California (CCPA and CPRA): we do not sell personal information and do not share it for cross-context behavioral advertising. Affiliate partners receive only an attribution parameter that identifies VoyajeBoard as the referrer. Where the law requires it, we honor Global Privacy Control signals. Verifiable consumer requests are answered within 45 days, and we do not discriminate against anyone who uses these rights.
Brazil (LGPD): VoyajeBoard is Controller of consumer personal data. Rights under LGPD Article 18 are honored. The data protection authority is the ANPD.
Quebec (Law 25): the responsible person for personal information protection is reachable at support@voyajeboard.com. VoyajeBoard has elected not to publicly name an individual under Section 3.1 of the Act; written requests are routed internally to the responsible person.
Governance Roles
VoyajeBoard's processing activities do not require a Data Protection Officer under GDPR Article 37: we are not a public authority, our core activities are not large-scale systematic monitoring of data subjects, and we do not process special categories of personal data at scale. EU and UK Article 27 Representatives will be appointed before any campaign that specifically targets data subjects in those regions and will be listed here when active.
All data-protection inquiries: support@voyajeboard.com.
Postal address: Voyajer Media LLC, 1320 N. Wicker Park Ave, Chicago, IL 60622, USA.
Changes To This Policy
We may update this policy from time to time. Material changes will be announced through an in-app notice, a banner on voyajeboard.com, or an email to the address associated with your account.